Dr Ismini Vasileiou, EMCSC founder and director explores why the UK’s cyber skills challenge is not simply about increasing the number of specialists entering the profession, but about building the organisational capability, confidence and regional partnerships needed for lasting cyber resilience.

The UK’s latest cyber security labour market report highlights a challenge that goes beyond the shortage of cyber professionals. As artificial intelligence transforms the workforce and organisations become increasingly dependent on digital technologies, how do we ensure that our approach to cyber skills, education and workforce development keeps pace?

 

The government’s Cyber Security Skills in the UK Labour Market 2026 report, published today, reveals that 57% of UK businesses have basic technical cyber skills gaps, up from 49% in the previous study. Almost half of those responsible for cyber security in businesses and charities lack confidence in dealing with cyber attacks and have not outsourced this responsibility.

 

At the same time, AI is reshaping the profession. Some 70% of cyber security businesses report that staff use AI in their daily work, while enrolments in cyber security specific apprenticeships have fallen by 15%. Women account for just 16% of the cyber security workforce. 

These findings raise important questions about how we develop future talent, support businesses and strengthen organisational resilience. They also reinforce the need to connect national policy with practical delivery at regional and local levels.

 

Are we preparing people for cyber security jobs?

The report presents an increasingly complex picture of the UK cyber security labour market.

While the number of cyber security graduates continues to grow, workforce growth has slowed. The report estimates that the UK cyber security workforce grew by just 2%, reaching approximately 145,900 people. Although advertised demand for cyber professionals has shown some signs of recovery, employers are also navigating changing recruitment requirements and the growing use of AI. 

 

This creates a particular challenge for people entering the profession. As AI and automation increasingly undertake routine tasks, some of the activities through which junior cyber professionals traditionally develop their experience are changing.

 

The implications extend beyond education and recruitment. If traditional entry routes are changing, employers, universities and training providers need to reconsider how people acquire practical experience, develop professional judgement and progress into more specialised roles.

 

Dr Ismini Vasileiou, Founder and Director of the East Midlands Cyber Security Cluster (EMCSC), said: “Technological advancement has always changed the nature of work, but the pace at which AI is transforming the cyber security profession raises important questions about how we prepare people for the future.

 

“We cannot simply focus on producing more cyber graduates or teaching people how to use new technologies. We need to understand what skills organisations actually require, how people will acquire practical experience as traditional entry roles evolve, and how education and industry can work together to respond.

“At the same time, cyber resilience is not exclusively the responsibility of technical specialists. It depends on leadership, organisational culture, human behaviour and the ability of businesses to access and apply the expertise they need.”

 

From national skills challenges to regional delivery

Addressing these challenges requires more than identifying skills shortages at a national level. It requires practical interventions that connect education, employers and regional economies, while creating opportunities for people from different backgrounds to enter and progress within the profession.

 

This approach has been central to EMCSC’s work.

 

Through two government funded programmes, CyberSprint and Cyber Growth, the Cluster has developed initiatives addressing different stages of the cyber skills and business development journey.

 

CyberSprint: Fast Track to the Future focused on strengthening the regional cyber skills pipeline and widening access to cyber careers. The programme engaged 93 schools and colleges and supported continuing professional development, alternative pathways into cyber security and opportunities for individuals without traditional IT backgrounds to develop relevant skills.

 

By aligning its approach with professional and government skills frameworks, including those developed by the Chartered Institute of Information Security, the Skills Framework for the Information Age and the Government Digital and Data Profession, CyberSprint sought to strengthen the connection between education, professional development and workforce requirements.

CyberGrowth: Unlocking Innovation and Opportunity extended this approach by connecting cyber skills with business innovation, growth and collaboration.

 

The programme brought together three complementary strands: an incubator designed to support 15 SMEs, an accelerator for 10 organisations and an enterprise strand connecting five organisations with student placement opportunities.

 

Its design recognised that regional cyber capability depends not only on developing talent but also on helping businesses innovate, access expertise, build partnerships and create opportunities for emerging professionals.

 

Together, CyberSprint and Cyber Growth demonstrate how regional programmes can connect education, workforce development and business innovation, rather than treating them as separate challenges.

 

They also offer a foundation for examining how regional interventions can be evaluated, sustained and adapted to meet changing national priorities.

 

Cyber resilience requires more than technical skills

One of the most significant findings in the government’s latest report concerns the confidence of those responsible for managing cyber security within organisations.

 

The report found that 47% of cyber leads in businesses and charities lacked confidence in dealing with cyber attacks or breaches and had not outsourced this responsibility. 

This raises a broader question about organisational capability.

 

Developing a larger cyber workforce is important, but it does not automatically mean that organisations are better equipped to manage cyber risks. Businesses also require informed leadership, appropriate governance, an understanding of human behaviour and the ability to adapt to technological change.

 

For SMEs, which may lack the resources to maintain dedicated cyber security teams, access to trusted expertise and opportunities for collaboration can be particularly important.

There is also a need to recognise that cyber resilience extends beyond individual organisations. Businesses increasingly operate within interconnected supply chains and digital ecosystems, where weaknesses or disruptions can have consequences beyond their immediate operations.

Developing organisational resilience therefore requires a more connected approach, bringing together technical expertise, workforce development, organisational practices and collaboration across sectors.

 

Connecting skills, inclusion and innovation

The report also highlights the continuing challenge of workforce diversity.

 

Women represent just 16% of the cyber security workforce, compared with 48% of the wider UK workforce. The report also identifies a substantial gap in the representation of disabled people. 

These findings reinforce the importance of widening participation, but the challenge does not end with encouraging more people to consider cyber careers.

 

We also need to examine how people progress, whether existing pathways accommodate different educational and professional backgrounds, and how employers can create environments in which a diverse workforce can develop and retain expertise.

 

For regional partnerships such as EMCSC, this means connecting education and outreach with meaningful opportunities for professional development, employer engagement and business growth.

 

It also means ensuring that initiatives are responsive to changing workforce requirements rather than being designed around assumptions about the types of roles that have traditionally existed.

As AI continues to transform cyber security, inclusion, skills development and technological innovation must be considered together.

 

From policy to place: What needs to happen next?

The latest government findings provide further evidence of the need to connect national cyber security ambitions with regional delivery.

 

Programmes such as CyberSprint and Cyber Growth offer practical examples of how regional partnerships can bring together universities, schools, colleges, employers and government to address skills and innovation challenges.

 

However, the longer term challenge is ensuring that such initiatives contribute to sustainable outcomes, including workforce progression, business growth and stronger organisational cyber resilience.

 

This is the focus of EMCSC’s forthcoming policy briefing, Beyond Policy to Place: Building the Delivery Infrastructure for Cyber Resilient Growth, developed in collaboration with De Montfort University and the Research Institute for Sociotechnical Cyber Security (RISCS).

Building on parliamentary engagement and a roundtable held at the Royal Society in June, the briefing examines how national policy can be translated into practical delivery through stronger regional collaboration and organisational capability.

 

The 2026 labour market report adds further urgency to this conversation.

 

The challenge is no longer simply how many cyber professionals the UK needs. It is how we develop the right capabilities, create sustainable pathways into the profession, support businesses as technologies evolve and ensure that national investment translates into measurable outcomes.

 

If we want to strengthen the UK’s cyber resilience, we must connect skills development with organisational capability and ensure that regional partnerships play a meaningful role in turning national ambitions into practical action.

 

Read the full government report: Cyber Security Skills in the UK Labour Market 2026